Web of Trust itself is the problem

[makrober]

Andre Amorim wrote:

> What are your thoughts about that ? 
> http://www.cs.rice.edu/~mtd3/comp527/comp527presentation.pdf

Well, here are some thoughts:

The presentations starts with:
"Why isn’t PGP widely used?"

The first point ("Designed around the E-mail") is absolutely correct.
E-mail is not the only communication channel that needs protection
now, and I strongly suggest that it will be less and less prominent
in the future. There is an awful lot of crud in g/pgp that complicates
the use in contexts other than e-mail.

But the rest of the "Why isn't [it] used" is plain wrong.

G/PGP isn't widely used because it does not address adequately the
real-life operational circumstances of the potential user, and
Web of Trust is the main culprit. It brings an enormous burden to
the development and - consequently - to the daily use of the system.
This burden is of such magnitude that it prevents all but technically
very competent computer users from adopting the system. Yet it
addresses the need that is present, I propose, only for a very minor
segment of users: those that would like to communicate in secrecy
but have not had a previous trusted relationship.

*Most individuals will rarely, if ever, be motivated to communicate
in secrecy with someone they don't already have a trusted
relationship with*.

This simple fact seems to me to be an issue that goes to the core
of the design synopsis of a system such as g/pgp. On the other hand,
the inverse of it has been built so deep into the system that
somehow it appears impossible to discuss it "sine ira et studio".

On the other hand, WoT brings with it an immense problem for a
large number of those that need to communicate in secrecy: it is
providing an adversary with a traffic analysis tool that he can
only wish for. To state - as those who promote the system in its
present shape do - that they should not worry about this fact is
naive. The current change of legal landscape is undeniable: not
only can various magistrates force the user to reveal his
cryptographic key, but it has become common that such keys must
be produced, often years after the fact, in civil litigations.
In this combination of technical characteristics of the product
and wider environment in which it is used, we simply must ask
ourselves:

Just who is left to use the system and why would he or she want
to do it?

Or - Web of Trust isn't the solution, Web of Trust is the problem.
Consequently, a WoT "improvement mechanism" such as outlined in
the presentation is, unfortunately, extremely unlikely to advance
the adoption of g/pgp.

MacRober